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DETAILED ACTION 

1 . The application having Application No. 10,074,842 has a total of 29 claims 
pending in the application; there are 5 independent claims and 24 dependent 
claims, all of which are ready for examination by the examiner. Claims 1-29 have 
been examined. 

Claim Rejections - 35 USC § 103 

2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

3. Claim 1-29 is rejected under 35 U.S.C. 103(a) as being unpatentable over 
Smithson etal., U.S. Patent No. 6,898,715, filed Sep. 12, 2000 (herein referred 
to as Reference A) in view of Edwards, How to Detect Certain Virus and Worms, 
published May 16, 2000 

httD://www.windowsitpro.com/articles/print.cfm?articleid=9523 (herein referred to 
as Reference B). 

4. As per claim 1 , Reference A discloses a method of virus control for a plurality of 
clients of an e-mail server, said e-mail server associated with a network, said 
method comprising: centrally monitoring for a pre-defined activity at any of said 
plurality of clients (Reference A, pg. 5, lines 1-5 & 8-10; Smithson embodiment 
of the centralized e-mail server applies to the limitations disclosed in the 
application); on discovery of said pre-defined activity at a given one of said 
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plurality of clients, blocking e-mail traffic from said given client (Reference A, fig. 
5, legend & step 7-8). Reference A does not disclose said pre-defined activity 
comprising receiving an e-mail message from said given client having a pre- 
defined recipient address. However Reference B discloses a dummy user in the 
address book to help detect future viruses by creating a fictitious user with a 
bogus email address, a user can make the e-mail service generate an onscreen 
error message about that bad address anytime it's used to send email, including 
when used by a virus or worm (Reference B, para. 2). At the time of the 
invention it would have been obvious to one of ordinary skill in the computer art 
to create fictitious user e-mail account of Reference B as an additional defined 
rule of Reference A. The motivation for doing so would have been to further 
enhance the rule set of Reference A in order to better detect computer viruses 
and worms. 

5. As per claim 2, the method of claim 1 wherein said pre-defined recipient address 
addresses a fictitious recipient (Reference B, para. 2). 

6. As per claim 3, the method of claim 1 logging e-mail messages sent by said 
plurality of clients in a message log (Reference A, fig. 1, step 18; mail servers log 
e-mail messages), given client, searching said message log for other e-mail 
messages sent by said given client (Reference B, para. 2; pg. 2, line 53-57; on- 
demand scan of the infected host). 

7. As per claim 4, the method of claim 3 further comprising: on finding one or more 
of said other e-mail messages, identifying recipient addresses in said one or 
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more other e-mail messages and sending a virus alert e-mail message to each 
identified recipient address (Reference A, pg. 10, line 9). 

8. As per claim 5, the method of claim 1 wherein said blocking e-mail traffic from 
said given client comprises dropping e-mail from said given client (Reference A, 
pg. 10, lines 17-19). 

9. As per claim 6, the method of claim 1 wherein said centrally monitoring 
comprises monitoring at an e-mail server (Reference A, pg. 5, lines 1-5 & 8-10). 

10. As per claim 7, the method of claim 1 further comprising, on discovery of said 
pre-defined recipient address in said e-mail message from said given client, 
sending a virus alert message to said given client (Reference A, pg. 10, line 9). 

1 1 .As per claim 8, 27 and 29, Reference A discloses the method, processor, and 
computer readable medium of virus control at a server side for a plurality of 
clients, said server side handling e-mail traffic to and from a network, comprising: 
receiving an e-mail message at said server side from a given client of said 
plurality of clients (Reference A, fig. 1 , step 18); Reference A does not explicitly 
disclose checking a recipient address of said e-mail message for a pre-defined 
recipient address and on discovery of said pre-defined recipient address, 
blocking e-mail traffic from said given client However, Reference B discloses 
checking a recipient address of said e-mail message for a pre-defined recipient 
address (Reference B, para. 2; Reference A, fig. 5, legend & step 7-8); on 
discovery of said pre-defined recipient address, blocking e-mail traffic from said 
given client (Reference B, para. 2; Reference A, fig. 5, legend & step 7-8). At the 
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time of the invention it would have been obvious to one of ordinary skill in the 
computer art to take the fictitious e-mail address of Reference B and block the e- 
mail traffic using the rules of Reference A. The motivation for doing so would 
have been to further enhance the rule set of Reference A in order to better detect 
computer viruses and worms. 

12. As per claim 9, the method of claim 8 farther comprising: logging e-mail 
messages sent by said plurality of clients in a message log (Reference A, fig. 1 , 
step 18); on said discovery of said pre-defined recipient address in said e-mail 
message from said given client, searching said message log for other e-mail 
messages sent by said given client (Reference A, pg. 10, line 16; pg. 2, line 53- 
57). 

13. As per claim 10, the method of claim 9 wherein said searching comprises 
searching for messages sent by said given client within a pre-determined time of 
a time of sending of said e-mail message (Reference A, pg. 10, line 16; pg. 2, 
line 26-31; timing of message can be set). 

14. As per claim 1 1, the method of claim 9 further comprising: on finding one or more 
of said other e-mail messages, identifying recipient addresses in said one or 
more other e-mail messages and sending a virus alert e-mail message to each 
identified recipient address (Reference A, pg. 10, line 9; recipients can be notified 
via e-mail). 

15. As per claim 12, the method of claim 9 further comprising: on finding one or more 
of said other e-mail messages, identifying each recipient address and, where an 



Application/Control Number: 10/074,842 Page 6 

Art Unit: 2132 

identified recipient address is for one of said plurality of clients, blocking all e-mail 
traffic from said one of said plurality of clients (Reference A, fig. 5, legend & step 
7-8). 

16. As per claim 13, the method of claim 11 wherein said searching comprises 
searching for messages sent by said given client within a pre-determined time of 
a time of sending said e-mail message (Reference A, pg. 10, line 16; pg. 2, line 
26-31). 

17. As per claim 14, the method of claim 11 wherein said searching comprises 
searching in reverse time order from a time of sending of said e-mail message for 
a pre-determined number of messages sent by said given client (Reference A, 
pg. 10, line 16; pg. 2, line 53-57). 

18. As per claim 15, the method of claim 8 wherein said checking comprises 
checking said recipient address of said e-mail message against a list of recipient 
addresses (Reference A, fig. 5, legend & step 7-8; Reference B, para. 2). 

19. As per claim 16, the method of claim 8 wherein said blocking e-mail traffic from 
said given client comprises dropping e-mail traffic received from said given client 
(Reference A, fig. 5, legend & step 7-8). 

20. As per claim 17, the method of claim 9 wherein said logging e-mail messages 
comprises logging sending and receiving addresses from said e-mail messages 
along with times of sending (Reference A, fig. 1 , step 18). 
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21. As per claim 18, the method of claim 8 further comprising: on discovery of said 
pre-defined recipient address, sending an alarm notification (Reference A, pg. 
10, line 9; Smithson teaches notifications via e-mail, pager and network 
broadcast). 

22. As per claim 19, the method of claim 15 wherein said list of recipient addresses 
comprises addresses beginning with at least a majority of letters of the alphabet 
(fig. 5, legend & step 7-8). 

23. As per claim 20, Reference A discloses a method for facilitating virus control, 
comprising: plurality of clients of an e-mail server, which data normally contains 
e-mail addresses (Reference A, fig. 1 , step 18). Reference A does not explicitly 
disclose salting stored data with a plurality of fictitious e-mail addresses, each of 
said addresses having a valid format (Reference B, para. 2). However, 
Reference B discloses salting stored data with a plurality of fictitious e-mail 
addresses, each of said addresses having a valid format (Reference B, para. 2). 
At the time of the invention it would have been obvious to one of ordinary skill in 
the computer art to take the fictitious e-mail address scheme of Reference B and 
apply it as an additional rule set for Reference A. The motivation for doing so 
would have been to further enhance the rule set of Reference A in order to better 
detect computer viruses and worms. 

24. As per claim 21 , the method of claim 20 wherein said stored data comprises at 
least one of an address book of an e-mail application, a message store of an e- 
mail application, and a web page (Reference B, para. 2; the e-mail that is 
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described in Reference B can be accessed via any of the three methods 
described in this claim). 

25. As per claim 22, the method of claim 20 further comprising choosing said 
fictitious e-mail addresses such that for each letter of a majority of letters of the 
alphabet there is a fictitious e-mail address beginning with said letter (Reference 
B, para. 2). 

26. As per claim 23, the method of claim 20 further comprising: storing said plurality 
of fictitious e-mail addresses for each of said plurality of clients at said e-mail 
server (Reference B, para. 2). 

27. As per claim 24, the method of claim 20 further comprising: on receiving, at said 
e-mail server, an e-mail message from a given client addressed to one of said 
plurality of fictitious addresses, blocking all e-mail traffic from said given client 
(Reference A, fig. 5, legend & step 7-8; Reference B, para. 2). 

28. As per claim 25, the method of claim 24 wherein said e-mail server is a simple 
mail transfer protocol server (Reference A, fig. 5, legend & step 7-8; Reference 
B, para. 2; the mail server described uses SMTP). 

29. As per claim 26, the method of claim 24 wherein said blocking all e-mail traffic 
from said given client comprises at least one of blocking e-mail traffic having a 
source address pointing to said given client and blocking e-mail traffic having a 
network address most recently associated with said given client (Reference A, 
fig. 5, legend & step 7-8; Reference B, para. 2). 
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30. As per claim 28, the processor of claim 27 further comprising a hit list for storing 
said plurality of pre-defined addresses (Reference B, para. 2; Reference A, fig. 5, 
step 7 & 8). 

Conclusion 

31 .Any inquiry concerning this communication or earlier communications should be 
directed to Nima Khomassi whose telephone number is (571) 272-3775. The 
examiner can normally be reached Monday-Friday from 8:30 AM to 5:00 PM. 

32. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Gilberto Barron Jr., can be reached at (571) 272-3799. 

33. The fax number for Formal or Official faxes to Technology Center 2100 is 571- 
273-8300. On July 15, 2005, the Central Facsimile (FAX) Number changed from 
703-872-9306 to 571-273-8300. As of September 15, 2005, the old number is no 
longer in service and 571-273-8300 is the only facsimile number recognized for 
centralized delivery. 

34. Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR 
only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have any questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-21 7-91 97 (toll- 
free). 
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